Integrated Scripting vulnerable to arbitrary code execution via Java reflection
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior to versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 may be vulnerable to arbitrary code execution. By using Java reflection on a thrown exception object it's possible to escape the JavaScript sandbox for IntegratedScripting's Variable Cards, and leverage that to construct arbitrary Java classes and invoke arbitrary Java methods. This vulnerability allows for execution of arbitrary Java methods, and by extension arbitrary native code e.g. from `java.lang.Runtime.exec`, on the Minecraft server by any player with the ability to create and use an IntegratedScripting Variable Card. Versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 fix the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CyclopsMC | IntegratedScripting | before 1.21.1-1.0.17; before 1.21.4-1.0.9-254; before 1.20.1-1.0.13; before 1.19.2-1.0.10 | 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, 1.19.2-1.0.10 | Patch available | CNA |
- IntegratedScripting VendorCyclopsMC Affected before 1.21.1-1.0.17; before 1.21.4-1.0.9-254; before 1.20.1-1.0.13; before 1.19.2-1.0.10 Fixed in 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, 1.19.2-1.0.10 Patch available CNA
Remediation
- Fix · CNA IntegratedScripting (CyclopsMC) Fixed in 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, 1.19.2-1.0.10
Timeline
- 2026-10-02 Threatist record created from CVE-2025-27107
References
Other 3
- https://github.com/CyclopsMC/IntegratedScripting/security/advisories/GHSA-2v5x-4823-hq77
- https://github.com/CyclopsMC/IntegratedScripting/blob/29051aace619604fb5dd60624b72dba428fea2f2/src/main/java/org/cyclops/integratedscripting/evaluate/ScriptHelpers.java#L46
- https://github.com/CyclopsMC/IntegratedScripting/blob/29051aace619604fb5dd60624b72dba428fea2f2/src/main/java/org/cyclops/integratedscripting/evaluate/translation/ValueTranslators.java
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences